CVE-2023-25117: Buffer Overflow
Multiple buffer overflow vulnerabilities exist in the vtyshubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pattern. A specially crafted HTTP request can lead to arbitrary code execution. An attacker with high privileges can send HTTP requests to trigger these vulnerabilities.This buffer overflow occurs in the setopenvpnclient function with the localvirtualip and the localvirtualmask variables.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25117?
CVE-2023-25117 is a vulnerability that exists in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 firmware due to buffer overflow vulnerabilities.
How severe is CVE-2023-25117?
CVE-2023-25117 has a severity rating of 7.2 (High).
What is the affected software for CVE-2023-25117?
The affected software for CVE-2023-25117 is Milesight UR32L v32.3.0.5 firmware.
What is the CWE for CVE-2023-25117?
The CWE for CVE-2023-25117 is CWE-119, CWE-121, and CWE-787.
How can this vulnerability be exploited?
This vulnerability can be exploited by sending a specially crafted HTTP request to trigger arbitrary code execution.